📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A recent analysis shows AI is making cyber attackers more dangerous and harder to distinguish, challenging existing threat evaluation models. The trend indicates increased risks for organizations worldwide.
New research from Anthropic indicates that AI is fundamentally changing the landscape of cyber threats, making attackers more capable and harder to identify using traditional methods. The report examines over 800 malicious accounts and finds that AI is increasingly used to automate complex attack techniques, shifting the threat profile and undermining established threat assessment heuristics.
Anthropic’s analysis of 832 banned accounts from March 2025 to March 2026 shows that 67.3% used AI to prepare malware, a foundational step in cyberattacks. More notably, 6.5% employed AI for advanced tasks like lateral movement within networks, with the share of high-risk actors rising from 33% to 56% over the year. The use of AI shifted from initial access techniques, such as phishing, to post-compromise activities, indicating a trend toward deeper, more sophisticated intrusions.
Crucially, the traditional markers of threat level—such as the number of techniques used or the tools employed—no longer reliably distinguish dangerous actors. Both novice and highly skilled attackers now appear similar in their technique count, as AI supplies many of the methods, blurring the lines of threat assessment. The report highlights that the most dangerous actors focus their AI use on complex, resource-intensive activities, but even this signal is weakening as more actors adopt similar approaches.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
cybersecurity threat detection software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
AI-powered malware analysis tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
network security monitoring devices
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
cyber threat intelligence platforms
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Impact of AI on Threat Detection and Defense Strategies
This development signifies a paradigm shift in cybersecurity. The reliance on traditional heuristics—technique diversity and tooling—becomes ineffective as AI levels the playing field, enabling less skilled actors to perform sophisticated attacks. Organizations must reconsider their threat models and defenses, recognizing that threat capability no longer correlates with apparent skill or tool complexity. The democratization of attack techniques raises the risk of widespread, more damaging cyber incidents.
Evolution of Cyber Threat Assessment and AI Integration
Historically, cybersecurity threat assessment depended on analyzing the number of techniques, tools, and interfaces used by attackers. This approach assumed that more techniques and advanced tools indicated higher danger. Over recent years, threat actors have increasingly integrated AI to automate and enhance their attack workflows. The current analysis from Anthropic underscores how AI’s role has expanded from simple automation to enabling complex, post-breach activities, fundamentally altering threat dynamics since 2025.
“Our findings show a significant shift toward AI-assisted post-compromise activities, which increases the danger posed by less skilled actors and challenges existing defense paradigms.”
— Anthropic Report Authors
Unclear Impact of AI on Long-Term Threat Landscape
It remains uncertain how quickly threat detection tools and frameworks will adapt to these changes, or whether new models will emerge to better identify dangerous actors. The full extent of AI’s democratization of cyber attack capabilities and its impact on global cyber risk levels are still developing areas of understanding. Additionally, the specific methods attackers will adopt next, and how defenders can effectively counter them, are not yet clear.
Future Directions for Cybersecurity in an AI-Driven Era
Cybersecurity organizations are expected to revise threat assessment models, incorporating AI-aware detection techniques. Further research will likely focus on identifying more reliable indicators of threat risk that are less susceptible to AI automation. Governments and industry groups may also develop new standards and collaboration frameworks to counteract the increasing sophistication and accessibility of AI-enabled cyber threats.
Key Questions
How does AI make attackers more dangerous?
AI automates complex attack techniques such as lateral movement and account discovery, enabling less skilled actors to perform sophisticated intrusions that previously required expertise.
Why are traditional threat assessment methods failing?
Because AI supplies many of the techniques attackers use, the correlation between skill level and technique diversity no longer holds, making it harder to distinguish high-risk actors based on technique count or tools alone.
What should organizations do to defend against AI-enabled attacks?
Organizations need to update their threat detection models to account for AI-assisted activities and develop AI-aware security measures that can identify subtle signs of sophisticated, post-compromise behaviors.
Will AI continue to democratize cyber attack capabilities?
While current trends suggest increasing accessibility, the full long-term impact depends on how quickly defenders adapt and what new countermeasures are developed. The trend indicates a continued move toward broader attack capabilities.
Source: ThorstenMeyerAI.com
